PAM filtering via IP for SSH

Question

I know this is probably a bit of a nube question, but I need some input. So if I use last I can see my IP, and it's also in my auth log whether failed or accepted, eg.

Dec 9 19:30:16 wilhelm sshd[14211]: Failed password for root from 59.63.188.44 port 16257 ssh2

I want to know whether it is possible to only allow connections from IP's from a certain ISP. e.g. if I do whois X.X.X.X on my IP and grep for ISP:

root@wilhelm:~# whois X.X.X.X|grep <ISPNAME>
netname:        <ISPNAME>

So is it possible to add this to pam for SSH connections? Are there any disadvantages to this approach(except being locked out when in another location(portknocking maybe))? It's on a VPS so I'm not worried about internet dropping out. I can just use VNC if I absolutely have to. I have done a few quick searches on this and I'll continue to.

Answer 1

Not exactly by PAM, but yes, it is possible to do. You can set this up using tcp_wrappers by modifying your /etc/hosts.allow, if your distro provides you the aclexec extension:

sshd: aclexec whois %a | grep <ISPNAME>

Or you can wrap the command into script that you can easily call.

More info can be found in manual page for hosts_options(5).